key
AB-112
OAuth Authorization Server metadata (RFC 9728)
What it means
OAuth Authorization Server Metadata published at /.well-known/oauth-authorization-server.
Why it matters
Agents discover OAuth endpoints (authorization, token, introspection) through this metadata per RFC 9728.
✗
What's wrong
No /.well-known/oauth-authorization-server endpoint.
✓
What's right
{ "issuer": "https://api.example.com", "authorization_endpoint": "...", "token_endpoint": "..." } at /.well-known/oauth-authorization-server.
Check this rule on your site
Enter your URL to check just this one rule (AB-001).